@sema-agent/core 7.23.4 → 7.24.0

package/dist/tools/monitor.d.ts

@@ -42,6 +42,7 @@ import type { AgentTool, ExecutionEnv } from "../internal/harness-types.js";
 import { type MonitorTimers, type TaskRegistry } from "../core/task-registry.js";
 import type { TaskNotificationPayload } from "../core/task-notification.js";
 import type { ToolResultStore } from "../core/tool-result-store.js";
+import type { BashReadonlyRootBoundary } from "./fs/bash-readonly-classifier.js";
 export interface MonitorToolOptions {
     registry: TaskRegistry;
     /** Fallbacks when the runtime ctx carries no identity (direct mounts) — same posture as createBashTool. */
@@ -68,6 +69,10 @@ export interface MonitorToolOptions {
      *  task-registry-monitor.ts's spill helper). Absent ⇒ legal degrade, byte-identical rolling (no spill,
      *  same loss shape as before this design). */
     toolResultStore?: ToolResultStore;
+    /** The deployment's shell READ BOUNDARY — the SAME option `createBashTool` takes: this face spawns a
+     *  shell command too, so the seat that judges the WRITTEN spelling needs the leg that re-judges where the
+     *  kernel takes it. BUILT here, so a library mount is not fail-open on one face and closed on the other. */
+    readBoundary?: BashReadonlyRootBoundary | (() => BashReadonlyRootBoundary | undefined);
     /** RB-465-b (HRD-PTL-3 残件): spec-level retain (`TaskSpec.retainBackgroundProcesses`) — the SECOND
      *  retain lane, OR-composed with the env capability at the teardown sweep. Without this bit the mount
      *  could only see the env lane, so a deployment retaining per spec still got the "session ends it"

package/dist/tools/monitor.js

@@ -3,6 +3,7 @@ import { defineTool, errorResult } from "../core/tools.js";
 import { hasBackgroundShell } from "../core/background-shell.js";
 import { MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, } from "../core/task-registry.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { createShellCanonicalRecheck, MONITOR_ESCAPE_PROSE } from "./fs/fs-bash.js";
 import { thrownText } from "../core/thrown-value.js";
 const MONITOR_DESCRIPTION = "Run a shell command in the background and watch its stdout as a stream of events.\n" +
     "\n" +
@@ -42,6 +43,7 @@ function envBackgroundWallSec(caps, requestedSec) {
     return Math.min(base, cap);
 }
 export function createMonitorTool(env, opts) {
+    const canonicalRecheck = opts.readBoundary === undefined ? undefined : createShellCanonicalRecheck(env, opts.readBoundary, MONITOR_ESCAPE_PROSE);
     return defineTool({
         name: "Monitor",
         ...toolFace("monitor"),
@@ -68,6 +70,11 @@ export function createMonitorTool(env, opts) {
             const isPersistent = persistent === true;
             const timeoutMs = Math.min(MONITOR_MAX_TIMEOUT_MS, Math.max(1, Math.floor(timeout_ms ?? MONITOR_DEFAULT_TIMEOUT_MS)));
             const spawnTimeoutSec = isPersistent ? undefined : Math.ceil(timeoutMs / 1000) + 5;
+            const escape = await canonicalRecheck?.(command, ctx.signal);
+            if (escape !== undefined)
+                return escape;
+            if (ctx.signal?.aborted === true)
+                return errorResult("Error (Monitor): the call was cancelled before the watch started.");
             const spawn = await env.spawnBackground(command, {
                 ...(opts.cwdRef !== undefined ? { cwd: opts.cwdRef.current } : {}),
                 ...(spawnTimeoutSec !== undefined ? { timeout: spawnTimeoutSec } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.23.4",
+  "version": "7.24.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2395,
+  "count": 2397,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -1867,6 +1867,7 @@
     "devWorkflowScriptRunner": "variable",
     "diffToolRoster": "function",
     "directoryRuleAdmits": "function",
+    "displayUrlOf": "function",
     "distilledEquals": "function",
     "dotAtOrBelowFrontier": "function",
     "drainMemoryAnnouncements": "function",
@@ -2076,7 +2077,6 @@
     "namespacedRuleNameCovers": "function",
     "nextSyncBaseline": "function",
     "normalizeAgentName": "function",
-    "normalizeBaseUrl": "function",
     "normalizeForExactMatch": "function",
     "normalizeMemorySpec": "function",
     "normalizePeerName": "function",
@@ -2242,6 +2242,7 @@
     "resolveReadDenyBuiltins": "function",
     "resolveReasoning": "function",
     "resolveReasoningProfile": "function",
+    "resolveRequestRoot": "function",
     "resolveRouteCredential": "function",
     "resolveSubagentTranscriptTier": "function",
     "resolveTaskLimits": "function",
@@ -2255,6 +2256,7 @@
     "retryBackoffMs": "function",
     "riskSeverity": "function",
     "rosterMemberBoundProblem": "function",
+    "routeKeyOf": "function",
     "routePairingStatus": "function",
     "routePeerDeliveryReceipt": "function",
     "routePeerDroppedReceipt": "function",
@@ -4264,6 +4266,7 @@
     "devWorkflowScriptRunner": "stable",
     "diffToolRoster": "advanced",
     "directoryRuleAdmits": "advanced",
+    "displayUrlOf": "advanced",
     "distilledEquals": "stable",
     "dotAtOrBelowFrontier": "advanced",
     "drainMemoryAnnouncements": "advanced",
@@ -4473,7 +4476,6 @@
     "namespacedRuleNameCovers": "advanced",
     "nextSyncBaseline": "advanced",
     "normalizeAgentName": "advanced",
-    "normalizeBaseUrl": "advanced",
     "normalizeForExactMatch": "internal",
     "normalizeMemorySpec": "advanced",
     "normalizePeerName": "advanced",
@@ -4639,6 +4641,7 @@
     "resolveReadDenyBuiltins": "advanced",
     "resolveReasoning": "advanced",
     "resolveReasoningProfile": "advanced",
+    "resolveRequestRoot": "stable",
     "resolveRouteCredential": "advanced",
     "resolveSubagentTranscriptTier": "advanced",
     "resolveTaskLimits": "internal",
@@ -4652,6 +4655,7 @@
     "retryBackoffMs": "advanced",
     "riskSeverity": "advanced",
     "rosterMemberBoundProblem": "advanced",
+    "routeKeyOf": "advanced",
     "routePairingStatus": "advanced",
     "routePeerDeliveryReceipt": "advanced",
     "routePeerDroppedReceipt": "advanced",

package/wire-changes/core@7.23.5.json

@@ -0,0 +1,133 @@
+{
+  "repo": "core",
+  "version": "7.23.5",
+  "from": "0a77a55f973aa9bc0d816abcf25cccb21039bda6",
+  "to": "v7.23.5",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING of the retry ladder, no key change (#933): a fetch throw the RUNTIME raised while BUILDING the request (a base URL carrying userinfo, a malformed URL/method/header name, a GET with a body) is classified by `classifyFetchThrow` (`src/brain/errors.ts:328`) as `invalid_request` — not `network` — and never retried; `AssistantMessage.isApiErrorMessage` is deliberately absent on this class (nothing reached the wire). A base URL with userinfo is refused at brain CONSTRUCTION by `assertBaseUrlWithoutCredentials` (`src/brain/route-adjudicator.ts:91`) in all three factories and in the shared `resolveRequestRoot` for `Model.baseUrl` (rules −2; the message never echoes the password). Structural discriminator, two evidence forms: a transport error carries a `cause` with a connect code, or the `fetch failed` shell sentence; a bare `TypeError` with neither is a build refusal. WHO IS AFFECTED: an operator who saw a ~3-minute retry ladder on a deterministic configuration error (deploy on cli 1.0.121)."
+    },
+    {
+      "id": "F7",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING, `Monitor` tool (#938): the shell faces' execute-time canonical recheck (`createShellCanonicalRecheck`, `src/tools/fs/fs-bash.ts`, extracted verbatim from the Bash tool) is mounted on `Monitor` from the same `readBoundary` option; a watch whose established operands resolve outside the roots or onto a deny row is refused as the whole call result before `registerMonitor` (no task_id, no stream), with a pre-spawn cancellation guard. WHO IS AFFECTED: a deployment that watched a symlinked or globbed deny-listed file through Monitor at zero refusals."
+    }
+  ],
+  "closedSetMembers": [
+    {
+      "set": "FetchThrowClass",
+      "at": [
+        "src/brain/errors.ts:327"
+      ],
+      "newSet": true,
+      "added": [
+        "request_unbuildable",
+        "transport"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "MonitorToolOptions",
+      "at": [
+        "src/tools/monitor.ts:61"
+      ],
+      "added": [
+        "readBoundary"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "WorkflowRunSummary",
+      "at": [
+        "src/core/workflow-run-store.ts:35"
+      ],
+      "added": [
+        "errorCode"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    }
+  ],
+  "declarationMoves": [
+    {
+      "name": "PROBE_REASON_MAX",
+      "kind": null,
+      "onSurface": false,
+      "from": [
+        "src/core/checkpoint-store.ts"
+      ],
+      "to": [
+        "src/core/checkpoint-store.ts",
+        "src/core/untrusted-text.ts"
+      ]
+    }
+  ],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.isError",
+      "assertions": [
+        "G2.a",
+        "G2.b",
+        "G4.a",
+        "G4.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.structured",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "PersistedRule.rule",
+      "assertions": [
+        "G3.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ReversibilityVerdict.boundaryDeclined",
+      "assertions": [
+        "G3.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "WorkflowRunSummary.errorCode",
+      "assertions": [
+        "G1.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [
+      "MonitorToolOptions",
+      "WorkflowRunSummary"
+    ],
+    "sdk": [
+      "WorkflowRunSummary"
+    ],
+    "note": "scanned cli@c38ebaf9 server@3793eaf4 sdk@ace0d09 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "a11cee1b37ecec0004b3b2e31a6d5d51370dfa52"
+}

package/wire-changes/core@7.24.0.json

@@ -0,0 +1,249 @@
+{
+  "repo": "core",
+  "version": "7.24.0",
+  "from": "6b1dcaefbdd7abf1a39f17d67c3b926a94ddc75f",
+  "to": "v7.24.0",
+  "added": [
+    {
+      "name": "displayUrlOf",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/brain/route-adjudicator.ts:136",
+        "src/index.ts:3207"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "resolveRequestRoot",
+      "kind": "function",
+      "tier": "stable",
+      "at": [
+        "src/brain/route-adjudicator.ts:230",
+        "src/index.ts:3209"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "routeKeyOf",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/brain/route-adjudicator.ts:96",
+        "src/index.ts:3206"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    }
+  ],
+  "removed": [
+    {
+      "name": "normalizeBaseUrl",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/brain/route-adjudicator.ts:60",
+        "src/index.ts:3206"
+      ],
+      "breaking": true
+    }
+  ],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "BREAKING export removal, plus a NARROWING of what three already-shipped members carry (#950). `normalizeBaseUrl` is REMOVED; the same function ships as `routeKeyOf` (the pairing law's comparison value, query byte-preserved), and two new exports join it — `displayUrlOf` (the only spelling of a request root allowed into text) and `resolveRequestRoot` (the request-root law itself, exported because a custom brain is a seat that builds one). `RouteRefusalDetail.{entryBaseUrl, requestBaseUrl, configBaseUrl}`, `fixHint`, the exported `routeRefusalText` and the `route.base_url_changed_key_unchanged` notice now carry DISPLAY spellings: userinfo dropped, EVERY query value replaced with `«redacted»`, query NAMES kept (dropping the query whole would render two roots that differ only in their query as one string, so the refusal about that very pair would read `targets X … paired with X`), and a BARE query token (`?<token>`, no `=`) rendered as one placeholder with no name. An unparseable root is withheld by POSITION in all three credential positions — userinfo, query and fragment. The ARRIVAL-time refusal took the same rule: `assertServableRequestRoot` used to hand-compose its own spelling (`${protocol}//${host}${pathname}`), and for a NON-SPECIAL scheme `pathname` IS the opaque body, so `weird:u:<secret>@h/v1`, `blob:https://u:<secret>@h/x` and `mailto:u:<secret>@h` echoed the credential in the very sentence that refuses them (`ftp:`/`file:` are special schemes and did not — the leak was shape-dependent, which is why a spot fix at one call site would have missed it). It now names its root through `displayUrlOf`, the one renderer. Two predicates make the split explicit: `servableParse` (http/https only) answers the KEY's question, `composableParse` (has an authority, or a real path) answers the RENDERING's — an opaque body has neither and falls to the positional arm. Who needs it: any deployment whose gateway root carries a credential in the query (`?api_key=<secret>` rode `fixHint`, all three detail members, `routeRefusalText` and the catalog-swap notice into whatever a host logs). Who is hurt: a consumer importing `normalizeBaseUrl` (server, `src/hooks/hook-llm.ts` — a pure comparison, so a rename is the whole migration), and any consumer COMPARING those three members against a catalog. Compensation: `routeKeyOf` is the same function under the name that says what it is; identity is computed with it; the refusal codes, the two-leg disposition and every posture word are byte-unchanged, and a conformance vector (`deployment-mismatch-query-differs`) was added so an origin+path-only implementation is caught pairing a credential with someone else's tenant. One sibling seat took the same rule in the same pass: `primaryActivityArg` (`src/core/arg-summary.ts`) rendered a URL as `origin + pathname`, and for an OPAQUE-body scheme `origin` is the string `\"null\"` while `host` is empty — so `blob:https://u:<secret>@h/v1` came out as `nullu:<secret>@h/v1`, gluing a literal `null` onto a credential it had just failed to drop. The arm is now judged on `host !== \"\"` and falls to the same positional withholding."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "ADDITIVE wire key, plus one NARROWING of a TypeScript guarantee (#946). The `compacted` event gains `freedTokens?: number` — the engine's own structural delta (one structural sum over the pre-messages minus the same sum over the post-messages), clamped >= 0 at the mint, published from all three lanes (turn boundary, prompt-too-long recovery, end-of-task settle) through ONE `mintCompactedEvent`. `Hooks.postCompact`'s `PostCompactContext` gains the same member from the same source. `tokensAfter` and `triggerTokensBefore` stay, un-clamped and un-deleted, retyped as DIAGNOSTICS with `not subtractable` said at the type: the trigger gate reads a usage-ANCHORED figure whenever the provider's last usage is fresh while the post size is always structural + the fixed prompt overhead, so their difference mixes coordinates and goes negative on ordinary runs (measured: 3037 - 4591 = -1554 on the plain auto lane; 4237 - 4987 = -750 on a short-session `/compact`). Who needs it: any consumer rendering a context meter — the cli `/context` line drew its arrow from the two diagnostics. Who is hurt: a caller doing arithmetic on `RunnerDeps.onCompaction`'s `freedTokens`, which is now optional (it previously carried `preChars` when the post measurement failed — a fabricated `fully effective` that is never true of a landing which leaves a summary behind), and the two anti-thrash floor sites that used the `triggerTokens - freedTokens` fallback. Compensation: purely additive on the wire; absence is information (`freedTokens` missing = the post measurement failed, render `unknown`, never `0`); no measurement now means the floor does not move, the same non-suppressing direction the fabricated value was chosen for, without the claim."
+    },
+    {
+      "id": "F4",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING of the member re-dispatch ladder, no key and no text change (#941). `runTurn` retried every member turn that did not settle completed-with-text, once, with the identical objective, prompt, model and toolset — including terminals that cannot come out differently. The retry is now refused only for the two terminals the engine can POSITIVELY identify as deterministic: a `blocked` cause (a host `UserPromptSubmit` denial, taken at its word), and a `failed` whose code the governance table adjudicated TERMINAL, read off `classifySubagentError` — no second opinion about any code. Everything else keeps its second attempt, INCLUDING that classifier's `logic` bucket, which is an ELSE-ARM: `stream_torn` (a response lost before any content or finish reason, the textbook re-issuable failure) lives there and lost its retry under a first draft of this change. Who needs it: any deployment paying for team discussions — such a turn now costs one child run instead of two (measured on a scripted runner: 3 runs instead of 6 for a two-member, one-round discussion). Who is hurt: nobody observably — the `[unavailable: <status>/<code>]` marker, the discussion, the transcript and the budget accounting are unchanged in shape. Compensation: the deliberate divergence from the classifier's own `retryable` on two rows is stated at the seat, and the row-level fix belongs in that table (ticket #964), not at this seat."
+    },
+    {
+      "id": "F5",
+      "source": "behaviorFlips.summary",
+      "text": "FAILURE FACE, plus one NARROWING stated rather than announced (#942). ELEVEN sites still read a value the engine did not construct bare, and three were load-bearing: a third-party `execute`'s RETURN value was read by a `normalizeContent` running OUTSIDE `defineTool`'s own try, so a member behind a throwing getter, a revoked proxy handed back as `content`, or one hostile content block raised a raw `TypeError` past the tool wrapper; and `reduceToolEnd` (`src/core/runner/turn-attachments.ts:454`, the TENTH station, found on the real lane rather than in the diff) read a third-party `details` inside the harness's tool_end handler, outside that try and a SECOND time after the result store already walked the card — measured end to end with a Runner, a scripted brain and a third-party `ToolSpec`: a `type` getter that answered once and raised on the second read ended the whole run as `failed` / `provider.error` on turn one, and the model never reached turn two. The ELEVENTH is the ERROR-frame code lift (`src/core/runner/tool-end-body.ts:99-104`), which read `result.details` and then its `code` / `errorKind` / `delivered` bare — on a failure path, in the same handler, after the result store had already walked the same card once, so a member raising on that SECOND read ended the run. All of them now read through `readMember` / `isErrorLike`, with two structural changes rather than more guards: `defineTool`'s whole result-building path runs inside the one try it already had, and `errorCodeOf`'s coarse try is replaced by per-member reads so an unreadable link costs THAT link and the walk continues (`{ code: <throws>, cause: { code: \"x\" } }` now answers `x`, and used to answer nothing). The class-level rules have ONE home each beside the other readers (`thrownIs`, `thrownName`), four private copies folded in. Who needs it: any deployment mounting a BYOM or MCP tool whose result crosses a host seam or a realm boundary. Who is hurt: a consumer text-matching the failure words for a HOSTILE value (three text changes, each named in the changelog), and a BYOM tool returning a truthy non-`true` `terminate` — now read `=== true` rather than `?? false`, the one unannounced narrowing, stated here because every in-tree consumer already tested `=== true`. Compensation: no wire key, no code word and no text change for any readable value. A REGRESSION this batch introduced was caught by the merge-tree review and fixed in it: `readListLength` accepted any value carrying a numeric `length`, so a third-party card whose `newTodos` was the STRING `\"bad card\"` read as a 8-element list and CLEARED the todo snapshot. A list is an object with a length; a string is not one. Pinned with a Proxy-over-array positive control, so the guard cannot be tightened into refusing a real list."
+    },
+    {
+      "id": "F6",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING at construction, no wire key (#943). `openAiCompatChatSeat` screened its `baseUrl` for emptiness and nothing else, then built `${baseUrl}/chat/completions` by hand: a root carrying userinfo, a `file:`/`ftp:` scheme, or a spelling that is not a URL at all constructed cleanly and failed at `fetch` as a transport error indistinguishable from an outage, so the consolidation driver retried it for the whole backoff ladder. #933 closed the same three shapes at the three brain factories; this seat builds a request root too and was not asked. The root now goes through `assertServableRequestRoot`, the same law, judged at CONSTRUCTION, with the trailing-slash strip moved there too so the root is read once instead of once per call. The ENVELOPE stays this seat's (`config.memory_consolidation_driver`, like its sibling api-key and alias-model screens) because a host screens on that code and the driver routes config-class throws differently from transport ones; only the envelope is local, the question and its wording are the adjudicator's, and the original refusal is kept as `cause`. Who needs it: any deployment wiring `RunnerDeps.memoryConsolidationDriver.chat` as an endpoint triple. Who is hurt: a deployment whose distillation seat carried one of the three bad roots and relied on it failing late — it now refuses where it is configured. Compensation: a userinfo root is named as `[redacted-credentials]@host`, never echoed; servable roots are untouched."
+    },
+    {
+      "id": "F9",
+      "source": "behaviorFlips.summary",
+      "text": "TWO VALUE FLIPS on the credential egress/refusal vocabularies, one of them a NARROWING of what the memory write face accepts, no wire key (#954). The two vendor tables had diverged, measured on synthetic shapes: a `github_pat_`-shaped token rode `scrubSecrets` (`src/core/arg-summary.ts`) and `redactSecrets` (`src/core/untrusted-egress.ts`) VERBATIM — the prefixed-token row is structurally unable to match that spelling — while `detectSecret` (`src/core/memory.ts`) recognised it; in the reverse direction an `hf_`-shaped token was masked on the way out but ACCEPTED by the memory write face. The EGRESS face now strips `github_pat_`, an Azure `AccountKey=` and a PGP `PRIVATE KEY BLOCK` banner where they used to ride in clear, and the memory WRITE door now throws `MemoryGateError(\"memory.secret_detected\")` on an `hf_` token of twenty or more characters CARRYING A DIGIT, at all three write entrances (`remember`, and consolidation's ADD and UPDATE). A two-way reconciliation pin is added over the ROW SETS, their FLAGS and their TIERS — not just the rows: every vendor shape in the refusal table must be masked by the egress table, every vendor shape in the egress table must be refused by (or explicitly exempted from) the refusal table, a masking row must mask EVERY occurrence in one rendering rather than the first, and a row added to a composed tier outside the egress pass list is caught by the kind list. A vendor added in ONE place alone reds. Who needs it: any deployment whose MCP failure text, delegation step summaries, tool-argument summaries or memory writes can carry a vendor credential. Who is hurt: a deployment relying on an `hf_`-shaped value being writable into memory verbatim, and a consumer byte-comparing an egress rendering that now carries `[redacted]`. Compensation: the digit discriminator keeps an ordinary `hf_`-prefixed IDENTIFIER writable; shapes already recognised by both tables (`ghp_`, `AKIA`, `AIza`) are byte-unchanged; the point repair stops the divergence until a single `CREDENTIAL_VOCABULARY` closes it for good (design ticket #958). A qualifier alphabet mismatch was found in the same pass: the refuse-write banner accepted a DIGIT in the qualifier (`-----BEGIN RSA2 PRIVATE KEY-----`) while the egress banner did not, so that shape was refused at the write door and rode out in clear. Both faces now carry the same alphabet, and the parity nail's mirror was corrected with them."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "PostCompactContext",
+      "at": [
+        "src/core/hooks.ts:711"
+      ],
+      "added": [
+        "freedTokens"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    },
+    {
+      "type": "TaskEvent",
+      "at": [
+        "src/core/task-event.ts:265"
+      ],
+      "added": [
+        "compacted.freedTokens"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    }
+  ],
+  "declarationMoves": [
+    {
+      "name": "resolveRequestRoot",
+      "kind": "function",
+      "onSurface": true,
+      "from": [
+        "src/brain/route-adjudicator.ts"
+      ],
+      "to": [
+        "src/brain/route-adjudicator.ts",
+        "src/index.ts"
+      ]
+    }
+  ],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "engineNoticeCode",
+      "name": "route.base_url_changed_key_unchanged",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "compacted.freedTokens",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "task_progress.currentAction",
+      "assertions": [
+        "G6.a"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.errorCode",
+      "assertions": [
+        "G6.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.isError",
+      "assertions": [
+        "G4.a",
+        "G6.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.output",
+      "assertions": [
+        "G3.b",
+        "G6.a"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.structured",
+      "assertions": [
+        "G3.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ListAgentsRow.state",
+      "assertions": [
+        "G3.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "PostCompactContext.freedTokens",
+      "assertions": [
+        "G2.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RouteRefusalDetail.entryBaseUrl",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RouteRefusalDetail.fixHint",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RouteRefusalDetail.requestBaseUrl",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunnerDeps.memoryConsolidationDriver",
+      "assertions": [
+        "G5.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunnerDeps.onError",
+      "assertions": [
+        "G5.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskResult.terminal.code",
+      "assertions": [
+        "G4.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "NOT SCANNED: sema-cli, sema-server, sema-sdk — an empty list for those repos means \"not checked out\", not \"no consumer\""
+  },
+  "breakingCount": 1,
+  "breakingItems": [
+    "export removed: normalizeBaseUrl (function)"
+  ],
+  "toResolvedAt": "f1abe12bc6c9dfcc40b6c68dde97c4b7a201284f"
+}